Privacy Policy
FULCRUM Co., Ltd. ("FULCRUM", "we", "us") establishes and discloses this Privacy Policy pursuant to Article 30 of the Personal Information Protection Act of the Republic of Korea ("PIPA"), in order to protect the personal information of data subjects in connection with our website (flcrm.kr) and our applications and services (collectively, the "Services"), and to handle related grievances promptly and effectively.
Note on language. This English version is provided for convenience. In the event of any discrepancy between the Korean and English versions, the Korean version prevails. See 개인정보 처리방침.
1. Our Role in Processing Personal Information
FULCRUM operates a platform that connects taxpayers ("Users") with licensed tax agents and supports those tax agents in performing their engagements. Because of this structure, FULCRUM holds two distinct roles depending on the nature of the information processed, and different rules apply to each.
(a) Where FULCRUM is the personal information controller
With respect to personal information that FULCRUM collects and uses directly in connection with account registration and use of the Services (name, email address, mobile number, service usage records, and the like), FULCRUM acts as the personal information controller under PIPA and processes such information in accordance with, and bears responsibility under, this Policy.
(b) Where FULCRUM is a processor (entrusted party)
Where a User enters into an engagement with a tax agent through the Services, that tax agent becomes the personal information controller for the personal information required to perform the engagement, and FULCRUM acts as an entrusted party (processor) under Article 26 of PIPA, processing such information on the tax agent's behalf.
In that capacity FULCRUM processes personal information only within the scope of the tax agent's instructions, and does not use it beyond the entrusted purpose or provide it to third parties. Information in this category includes the User's resident registration number and tax records held by the National Tax Service and local governments.
In short — FULCRUM is responsible for your account information; the tax agent you engage is responsible for the tax records used to perform your engagement, and FULCRUM stores and processes those records solely under that agent's instruction.
Requests to access, correct, or delete information that FULCRUM holds as a processor should generally be directed to your tax agent. If you contact us instead, we will forward your request to the tax agent and support its handling.
2. Categories of Personal Information Collected
(a) Account registration and use of the Services (FULCRUM as controller)
| Category | Items |
|---|---|
| Required | Name, mobile number, email address, password (or social login identifier), identity verification value (CI/DI) |
| Optional | Date of birth, address, occupation or income type, marketing consent status |
| Inquiries | Name, contact details, email address, contents of the inquiry and attachments |
| Automatically generated | IP address, access timestamps, browser type, operating system and device information, service usage records, records of misuse, cookies |
(b) Performance of tax engagements (FULCRUM as processor)
Where a User has engaged a tax agent and consented to the collection of records, FULCRUM processes the following on the tax agent's behalf.
| Category | Items |
|---|---|
| Unique identifying information | Resident registration number, alien registration number (where applicable), business registration number |
| Records held by the National Tax Service (Hometax) | Income records (employment, business, interest, dividend, pension, other income), income and tax deduction records, filing and payment history, electronic tax invoices, cash receipts and invoices, business registration particulars, engagement relationship information |
| Records held by local governments (Wetax) | Local income tax and other local tax filings, payments, assessments, and delinquency records |
| Documents submitted by the User | Supporting documents, contracts, books and accounting records, and other materials required for filing |
| Sensitive information (only with separate consent) | Health-related information such as medical expense deduction records, and disability deduction records |
FULCRUM does not collect records beyond the scope necessary for the tax services the User has selected. The specific scope is disclosed separately at the time consent to collection is obtained.
3. How We Collect Personal Information
- Direct entry by the User — through account registration, service requests, document uploads, and inquiries.
- Automatic collection — through generated-information collection tools during use of the Services.
- Collection of records held by public institutions — as described below.
Collection of records held by the National Tax Service (Hometax) and local governments (Wetax)
On behalf of the tax agent, and only within the scope the User has consented to in advance, FULCRUM collects the User's tax records by the following two methods. Under neither method do we collect records without the User's express consent.
| Method | Description |
|---|---|
| (i) Via tax agent engagement consent | Where the User has granted engagement consent to a tax agent on Hometax, FULCRUM collects the User's tax records as that tax agent's entrusted party, within the scope of the inquiry rights available to the tax agent. The User may revoke engagement consent on Hometax at any time, upon which collection by this method ceases immediately. |
| (ii) Via the User's simple authentication | Where the User verifies their identity through the simple authentication procedure provided by Hometax and consents to collection, FULCRUM collects the records held by the relevant institution on the User's own behalf. The User selects the authentication method themselves. |
Choice of authentication method — the authentication method is chosen by the User from the list offered by Hometax (KakaoTalk, Naver, Toss, carrier PASS, Samsung Pass, Banksalad, KakaoBank, and the KB, Shinhan, Hana, Woori and NH certificates, among others). FULCRUM neither designates nor recommends any particular provider, and enters into no data processing agreement with them.
Handling of authentication credentials — FULCRUM does not collect or store authentication credentials themselves, including User IDs and passwords, joint certificates and their passwords, or biometric data. Identity verification takes place between Hometax and the provider the User has selected; the name, date of birth and mobile number required to initiate authentication are passed to that procedure and are not stored or used for any other purpose.
FULCRUM uses only the authentication result value and a one-time token, for the scope and duration required for collection, and destroys them without delay thereafter.
4. Processing of Resident Registration Numbers
As a rule, FULCRUM does not process resident registration numbers. We process them only in the following circumstances, and only as an entrusted party acting for a tax agent.
(a) Legal basis
Under Article 24-2(1)(1) of PIPA, a resident registration number may be processed only where a statute specifically requires or permits it. A tax agent engaged by the User is required, in performing tax agency services under the Certified Tax Accountant Act (tax adjustment, filing on behalf of the taxpayer, bookkeeping services, and so on), to record the taxpayer's resident registration number on the returns and statements prescribed by the Income Tax Act, the Corporate Tax Act, the Framework Act on National Taxes and their enforcement decrees and rules. The tax agent therefore holds a legal basis to process resident registration numbers to that extent.
(b) FULCRUM's role — custody under entrustment
FULCRUM holds no independent legal basis to process resident registration numbers. We process them solely because a tax agent holding the legal basis described above has entrusted the necessary processing to us. As an entrusted party under Article 26 of PIPA, FULCRUM observes the following limits:
- We do not use resident registration numbers beyond the scope of the purpose entrusted by the tax agent.
- We do not use resident registration numbers for any purpose of our own, including member identification, marketing, statistics, or service development.
- We do not provide them to third parties or sub-entrust them without the tax agent's consent.
- Where the engagement terminates or the tax agent instructs destruction, we destroy them without delay, except where a statutory retention obligation applies.
(c) Safeguards
Resident registration numbers are stored in encrypted form in accordance with the Standards for Ensuring the Safety of Personal Information, and are masked when displayed. Access is granted only to the minimum personnel required to perform the work and to the tax agent engaged by the relevant User, and all access is logged and retained.
5. Processing of Sensitive Information
As a rule, FULCRUM does not process sensitive information. Where processing of health-related or similar sensitive information is necessary to apply deductions favourable to the User — such as medical expense or disability deductions — we process it only after obtaining express consent separate from consent to the processing of other personal information, in accordance with Article 23 of PIPA.
A User who does not consent may continue to use the remaining Services normally, although the relevant deduction may not be applied. Sensitive information is destroyed without delay once the filing for the applicable tax year is complete.
6. Purposes of Processing
- Member management — verifying intent to register, identity verification and authentication, maintaining membership, preventing misuse, delivering notices
- Service delivery — connecting Users with tax agents, collecting, organizing and analyzing tax records, providing filing and tax-saving diagnostics, providing content
- Supporting tax engagements — processing, storing and transmitting records required for a tax agent's engagement (as processor)
- Customer support — receiving and handling inquiries, retaining records for dispute resolution, notifying outcomes
- Service improvement — analyzing usage patterns and access frequency, compiling usage statistics, developing new services
- Security and legal compliance — maintaining service stability, preventing misuse, complying with tax and accounting laws
- Marketing (only with consent) — providing information on events and promotions
7. Retention and Use Periods
We destroy personal information without delay once the purpose of collection and use is achieved or the User withdraws from membership, except as follows.
(a) Retained with the User's consent
| Item | Retention period |
|---|---|
| Member information | Until withdrawal of membership |
| Records of misuse | 1 year from confirmation of misuse |
| Tax records (processed under entrustment) | Until termination of the engagement, subject to the statutory periods in (b) below |
(b) Retained under applicable law
| Item | Legal basis | Period |
|---|---|---|
| Books and supporting documents for tax filings | Framework Act on National Taxes, Art. 85-3 | 5 years |
| Records on contracts and withdrawal of subscription | Act on Consumer Protection in Electronic Commerce | 5 years |
| Records on consumer complaints and dispute resolution | Act on Consumer Protection in Electronic Commerce | 3 years |
| Records on labelling and advertising | Act on Consumer Protection in Electronic Commerce | 6 months |
| System access logs | Standards for Ensuring the Safety of Personal Information, Art. 8 (2 years, as we process unique identifying and sensitive information) | 2 years |
| Website visit records | Protection of Communications Secrets Act | 3 months |
8. Destruction Procedures and Methods
(a) Procedure
Where the retention period has elapsed or the purpose of processing has been achieved so that the personal information is no longer necessary, we destroy it without delay (within 5 days, absent justifiable cause). Information to be destroyed is identified when the cause for destruction arises and is destroyed with the approval of the Privacy Officer. For information processed as an entrusted party, we destroy it upon the tax agent's instruction, or once the statutory retention period following termination of the engagement has elapsed.
(b) Method
- Electronic files — permanently deleted using technical methods that render restoration impossible (degaussing, overwriting with dedicated secure-erase software).
- Paper documents — shredded or incinerated.
(c) Separate storage for inactive Users
We store and manage the personal information of Users who have not used the Services for one year separately from that of other Users, and notify the User of that fact and of the items concerned at least 30 days in advance.
9. Provision to Third Parties
We do not use personal information beyond the scope stated in this Policy or provide it to third parties, and we never sell personal information. The following are the exceptions.
| Recipient | Purpose | Items | Retention period |
|---|---|---|---|
| The tax agent engaged by the User (certified tax accountant, tax firm, or CPA) | Performance of the tax engagement | The tax records described in Section 2(b) | Until termination of the engagement (or the applicable statutory retention period) |
| The National Tax Service, local governments, and other tax authorities | Filing, payment, and other statutory obligations | Items required to be stated on returns and attachments | The period prescribed by law |
Provision to a tax agent occurs only where the User has selected that tax agent and consented to the engagement; no information is provided to tax agents the User has not engaged. Users may decline this provision, in which case the tax agency services cannot be provided.
We may otherwise disclose information where a statute so provides, or where an investigative authority so requires in accordance with the procedures and methods prescribed by law.
10. Entrustment of Processing
| Entrusted party | Scope of entrusted work | Retention period |
|---|---|---|
| Supabase Pte. Ltd. | Operation of cloud infrastructure — database, authentication, file storage | Until termination of the entrustment agreement or withdrawal of membership |
| Vercel Inc. | Hosting and content delivery for the website and applications | |
| Google LLC | Business email and document collaboration tools; web font delivery |
FULCRUM does not currently offer paid features, so there is no payment-related entrustment; and because simple authentication is carried out by the User through the procedure Hometax provides, there is no entrustment to authentication providers either.
When entering into entrustment agreements we specify, in accordance with Article 26 of PIPA, the prohibition on processing beyond the entrusted purpose, technical and administrative safeguards, restrictions on sub-entrustment, supervision of the entrusted party, and liability including damages; and we supervise whether the entrusted party processes personal information safely. Any change to the entrusted work or the entrusted parties will be disclosed through this Policy.
11. Overseas Transfer
We transfer personal information overseas as set out below. Each transfer constitutes entrustment or storage for the performance of a contract and for User convenience, and pursuant to Article 28-8(1)(3) of PIPA, disclosure in this Policy substitutes for separate consent.
| Recipient | Country | Items | Purpose | Time and method | Retention period |
|---|---|---|---|---|---|
| Supabase Pte. Ltd. (privacy@supabase.io) |
Singapore (entity location) Data storage location: Seoul, Republic of Korea (ap-northeast-2) |
All personal information processed for provision of the Services | Operation of cloud infrastructure — database, authentication, file storage | Transmitted over the network at the time of service use | Until termination of the entrustment agreement |
| Vercel Inc. (privacy@vercel.com) |
United States (processed across a global CDN; traffic may fail over to an adjacent region during an outage) | IP address, browser type, device information, access timestamps | Hosting and content delivery | ||
| Google LLC | United States | Email address, contents of inquiries and attachments, IP address, browser information | Business email and document collaboration tools; web font delivery |
The database in which FULCRUM stores personal information is located in the Seoul region of the Republic of Korea, and personal information is not physically stored outside Korea. We nonetheless disclose these transfers as overseas transfers because the entrusted providers are incorporated abroad and access from outside Korea may occur in the course of operation and maintenance.
Users may refuse the overseas transfer of their personal information. Because these transfers concern infrastructure essential to the Services, however, refusal means the Services cannot be provided in whole or in part. Notice of refusal may be sent to zelkovian@flcrm.kr.
In connection with overseas transfers we apply protective measures including encryption in transit pursuant to Article 28-8(4) of PIPA, and we enter into data processing agreements with recipients to secure a level of protection equivalent to that required under Korean law.
12. Cookies and Automatic Collection
We use cookies to store and retrieve usage information in order to provide individually tailored Services.
- Purpose — maintaining login state, managing secure sessions, and analyzing access frequency and usage patterns to improve the Services.
- What we do not do — we do not collect behavioural information for advertising purposes, and we do not provide behavioural information to third parties or use it for targeted advertising.
How to refuse cookies — you may refuse the storage of cookies or delete stored cookies through your browser settings:
- Chrome — Settings > Privacy and security > Third-party cookies (or Delete browsing data)
- Safari — Settings > Privacy > Manage Website Data
- Edge — Settings > Cookies and site permissions > Manage and delete cookies and site data
If you refuse cookies, you may have difficulty using parts of the Services that require login.
13. Automated Decision-Making
In the course of providing the Services we perform automated analysis of collected tax records, including automatic classification and the calculation of applicable deductions and estimated tax amounts.
These results are provided for reference only. The final determination of filing contents and whether to file rests with the User or the tax agent the User has engaged, following their review and approval. Accordingly, FULCRUM does not make automated decisions that significantly affect the rights or obligations of a data subject without human intervention within the meaning of Article 37-2 of PIPA.
Should we introduce fully automated decision-making in future, we will disclose the criteria and procedures, and the means of exercising the rights to refuse and to request an explanation, through this Policy in advance.
14. Pseudonymized Information
FULCRUM does not currently process pseudonymized information for statistical, scientific research, or public-interest archiving purposes.
Should we process pseudonymized information in future, we will disclose the purpose, items, and retention period in advance through this Policy, and will implement the safeguards required by Article 28-4 of PIPA — storing additional information separately and restricting access — to prevent re-identification.
15. Security Measures
(a) Administrative
- Establishment and implementation of an internal management plan, reviewed at least annually
- Designation of the minimum number of personnel handling personal information, with regular training
- Immediate revocation of access rights upon departure or change of duties
(b) Technical
- Encryption — unique identifying information including resident registration numbers, sensitive information, and passwords are stored using secure encryption algorithms. Passwords are stored as one-way hashes that cannot be decrypted.
- Encryption in transit — TLS (HTTPS) is applied to all communications.
- Access control — access rights to the processing system are granted at the minimum level necessary for each role, with intrusion prevention and detection systems in operation.
- Tenant isolation — data is logically isolated per tax agent and per User, so that a tax agent without an engagement cannot access another person's records.
- Access logging — system access logs are retained for at least two years, protected against forgery, alteration, theft and loss, and reviewed periodically.
- Backup and recovery — regular data backup and documented recovery procedures.
(c) Physical
- Systems storing personal information operate in access-controlled cloud data centres. FULCRUM does not physically hold documents or storage media containing personal information.
16. Rights of Data Subjects
Users may exercise the following rights against FULCRUM at any time:
- The right to request access
- The right to request correction of errors
- The right to request deletion (except where a statute imposes a retention obligation)
- The right to request suspension of processing
- The right to withdraw consent where processing is based on consent
- The right to request transmission of personal information, where the requirements of Article 35-2 of PIPA are met
How to exercise these rights
You may exercise these rights directly through [Settings > Privacy] within the Services, or by written or electronic request to zelkovian@flcrm.kr. We will act and notify you of the outcome within 10 days of receiving the request. We provide a means of exercising these rights no more burdensome than the means by which the information was collected, and charge no fee.
Rights may be exercised through a legal representative or an authorized agent, in which case a power of attorney in the form prescribed by Annex 11 of the Notice on Methods of Processing Personal Information must be submitted.
Limitations
- Where access is prohibited or restricted by statute
- Where there is a risk of harm to another person's life or body, or of unjustifiable infringement of another person's property or other interests
- Where deletion is requested for records subject to a retention obligation under the Framework Act on National Taxes or other law because a filing has already been completed
For information FULCRUM holds as a processor — rights concerning the tax records described in Section 1(b) should be exercised against the tax agent, who is the controller for that information. If you contact us instead, we will forward the request to the tax agent without delay and support its handling.
17. Children Under 14
FULCRUM does not accept registration by children under 14 and does not knowingly collect personal information from them. We verify age via date of birth during registration and block registration by children under 14.
If we learn that personal information of a child under 14 has been collected without the consent of a legal representative, we destroy it without delay and notify the legal representative. Legal representatives may contact zelkovian@flcrm.kr to request access, correction, deletion, suspension of processing, or withdrawal of consent regarding a child's personal information.
18. Privacy Officer
| Role | Details |
|---|---|
| Privacy Officer | Yongsoo Jung (Chief Executive Officer) |
| Contact | Tel +82-70-8058-8825 / Email zelkovian@flcrm.kr |
| Department for access requests | Privacy Team / zelkovian@flcrm.kr |
You may direct any inquiry, complaint, or request for remedy relating to privacy arising from your use of the Services to the Privacy Officer, and we will respond and act without delay.
19. Remedies for Infringement
You may apply to the following bodies for dispute resolution or consultation regarding infringement of personal information.
| Body | Function | Contact |
|---|---|---|
| Personal Information Dispute Mediation Committee | Dispute mediation, collective dispute mediation | 1833-6972 / www.kopico.go.kr |
| Privacy Infringement Report Centre (KISA) | Reporting and consultation on infringements | 118 / privacy.kisa.or.kr |
| Supreme Prosecutors' Office, Cyber Investigation Division | Criminal investigation | 1301 / www.spo.go.kr |
| National Police Agency, Cyber Bureau | Criminal investigation | 182 / ecrm.police.go.kr |
A person whose rights or interests are infringed by a disposition or omission of a personal information controller may also file an administrative appeal under the Administrative Appeals Act.
20. Changes to This Policy
This Policy may be supplemented, amended, or revised in response to changes in law, policy, or security technology. Where we change this Policy, we will announce the reasons and contents through in-service notices or this page at least 7 days before the change takes effect, or at least 30 days in advance where the change is unfavourable to Users.
Previous versions are listed in the Addendum below.
21. Company Information
FULCRUM Co., Ltd.
Chief Executive Officer: Yongsoo Jung
908, 11-15, Teheran-ro 77-gil, Gangnam-gu, Seoul, Republic of Korea
Business Registration No. 815-81-03797
Tel: +82-70-8058-8825
Email: zelkovian@flcrm.kr
Addendum
- This Policy takes effect on August 23, 2026.
- Previous version — effective August 20, 2026 (first edition)
In the event of any discrepancy in interpretation between the Korean and English versions of this Policy, the Korean version prevails.